Implement Software Supply Chain Risk Management (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST)) CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of maintaining a software bill of materials (SBOM) for a product?

   • ATo replace the need for code reviews and security testing
   • BTo provide a detailed inventory of third-party components, versions, licenses, and dependencies for transparency and vulnerability tracking
   • CTo document the internal development process and coding standards
   • DTo serve as a legal contract between the software vendor and the customer
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A developer wants to use a small utility library from a personal GitHub account. The library has no documentation, no releases, and the author has not responded to issues. What should the developer do?

   • AUse the library and review the source code manually.
   • BAvoid using the library and look for a more maintained alternative.
   • CUse the library because it is small and likely has few vulnerabilities.
   • DUse the library but add it to the SBOM.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company wants to automate the detection of known vulnerabilities in its third-party components. They have an SBOM for each product. What should they do to continuously monitor for vulnerabilities?

   • ARequire developers to report any vulnerabilities they find.
   • BIntegrate a vulnerability scanner that checks the SBOM against a vulnerability database.
   • CManually review the SBOM each month.
   • DSubscribe to security mailing lists and compare with the SBOM.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team is considering a component that has a known vulnerability, but the vulnerability is only exploitable if the component is used in a specific configuration that the team does not use. What should the team do?

   • ADocument the risk as low and accept it.
   • BUse the component but do not document the vulnerability.
   • CUse the component and hope the vulnerability is never exploited.
   • DReject the component because it has any vulnerability.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which factor is most important when assessing the risk of a third-party component that has not been updated in several years?

   • AThe component's popularity in online forums
   • BThe component's original release date, regardless of current support
   • CThe component's maintenance status, including whether it is still supported by the vendor or community
   • DThe number of lines of code in the component
   Reveal Solution Discussion Select an answer first